Re: New SSL beast Attack

2012-09-07 Thread Andrew S. Baker
Thanks, Z

* *

*ASB* *http://XeeMe.com/AndrewBaker* *Harnessing the Advantages of
Technology for the SMB market…

*



On Thu, Sep 6, 2012 at 12:53 PM, Ziots, Edward ezi...@lifespan.org wrote:

 BEAST creators develop new SSL attack - The H Security: News and Features:
 


 http://www.h-online.com/security/news/item/BEAST-creators-develop-new-SSL-attack-1702136.html
 

 ** **

 Z

 ** **

 Edward E. Ziots, CISSP, Security +, Network +

 Security Engineer

 Lifespan Organization

 ezi...@lifespan.org

 ** **

 ~ Finally, powerful endpoint security that ISN'T a resource hog! ~
 ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

 ---
 To manage subscriptions click here:
 http://lyris.sunbelt-software.com/read/my_forums/
 or send an email to listmana...@lyris.sunbeltsoftware.com
 with the body: unsubscribe ntsysadmin


~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

RE: Did y'all know...

2012-09-07 Thread David Lum
“If these policies are retained, then there will be a systematic vulnerability 
window. Microsoft will patch Internet Explorer, and then a week or two later, 
Adobe will reveal a raft of new Flash security flaws when it patches Flash. 
Windows users will then have to wait several weeks for Microsoft's next update”

Hopefully MS will sort this one out.

From: Richard Stovall [mailto:rich...@gmail.com]
Sent: Thursday, September 06, 2012 7:16 PM
To: NT System Admin Issues
Subject: Did y'all know...

... that MS baked Flash into IE 10, and that you can't update it outside of the 
Microsoft update release channel?

I discovered this tonight when Secunia PSI was screaming at me to update my 
shiny new Win 8 playpen, but then I couldn't do it because MS won't let me.

http://arstechnica.com/information-technology/2012/09/internet-explorer-10s-bundled-flash-leaves-users-exploitable/

Wow.

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


RE: Did y'all know...

2012-09-07 Thread Ken Schaefer
I’m pretty sure there’s a direct line between the Adobe Flash people and the 
Microsoft IE people…

From: David Lum [mailto:david@nwea.org]
Sent: Friday, 7 September 2012 11:32 PM
To: NT System Admin Issues
Subject: RE: Did y'all know...

“If these policies are retained, then there will be a systematic vulnerability 
window. Microsoft will patch Internet Explorer, and then a week or two later, 
Adobe will reveal a raft of new Flash security flaws when it patches Flash. 
Windows users will then have to wait several weeks for Microsoft's next update”

Hopefully MS will sort this one out.

From: Richard Stovall 
[mailto:rich...@gmail.com]mailto:[mailto:rich...@gmail.com]
Sent: Thursday, September 06, 2012 7:16 PM
To: NT System Admin Issues
Subject: Did y'all know...

... that MS baked Flash into IE 10, and that you can't update it outside of the 
Microsoft update release channel?

I discovered this tonight when Secunia PSI was screaming at me to update my 
shiny new Win 8 playpen, but then I couldn't do it because MS won't let me.

http://arstechnica.com/information-technology/2012/09/internet-explorer-10s-bundled-flash-leaves-users-exploitable/

Wow

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


Re: Did y'all know...

2012-09-07 Thread Jonathan Link
Your confidence in Microsoft amazes me...

On Fri, Sep 7, 2012 at 9:34 AM, Ken Schaefer k...@adopenstatic.com wrote:

  I’m pretty sure there’s a direct line between the Adobe Flash people and
 the Microsoft IE people…

 ** **

 *From:* David Lum [mailto:david@nwea.org]
 *Sent:* Friday, 7 September 2012 11:32 PM

 *To:* NT System Admin Issues
 *Subject:* RE: Did y'all know...

  ** **

 “If these policies are retained, then there will be a systematic
 vulnerability window. Microsoft will patch Internet Explorer, and then a
 week or two later, Adobe will reveal a raft of new Flash security flaws
 when it patches Flash. Windows users will then have to wait several weeks
 for Microsoft's next update”

 ** **

 Hopefully MS will sort this one out.

 ** **

 *From:* Richard Stovall [mailto:rich...@gmail.com]
 *Sent:* Thursday, September 06, 2012 7:16 PM
 *To:* NT System Admin Issues
 *Subject:* Did y'all know...

 ** **

 ... that MS baked Flash into IE 10, and that you can't update it outside
 of the Microsoft update release channel?

 ** **

 I discovered this tonight when Secunia PSI was screaming at me to update
 my shiny new Win 8 playpen, but then I couldn't do it because MS won't let
 me.

 ** **


 http://arstechnica.com/information-technology/2012/09/internet-explorer-10s-bundled-flash-leaves-users-exploitable/
 

 ** **

 Wow

 ~ Finally, powerful endpoint security that ISN'T a resource hog! ~

 ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

 ---
 To manage subscriptions click here:
 http://lyris.sunbelt-software.com/read/my_forums/
 or send an email to listmana...@lyris.sunbeltsoftware.com
 with the body: unsubscribe ntsysadmin



~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

RE: Did y'all know...

2012-09-07 Thread Ziots, Edward
NUTS! No Win8 for me J

 

Z

 

Edward E. Ziots, CISSP, Security +, Network +

Security Engineer

Lifespan Organization

ezi...@lifespan.org

 

From: Jonathan Link [mailto:jonathan.l...@gmail.com] 
Sent: Thursday, September 06, 2012 10:45 PM
To: NT System Admin Issues
Subject: Re: Did y'all know...

 

Chrome it is, then!

On Thursday, September 6, 2012, Richard Stovall wrote:

... that MS baked Flash into IE 10, and that you can't update it outside
of the Microsoft update release channel?

 

I discovered this tonight when Secunia PSI was screaming at me to update
my shiny new Win 8 playpen, but then I couldn't do it because MS won't
let me.

 

http://arstechnica.com/information-technology/2012/09/internet-explorer-
10s-bundled-flash-leaves-users-exploitable/

 

Wow.

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here:
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
javascript:_e(%7b%7d,%20'cvml',%20'listmana...@lyris.sunbeltsoftware.co
m'); 
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here:
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

RE: Did y'all know...

2012-09-07 Thread Daniel Rodriguez
Yeah. Like two tin cans and string. :)

Daniel
On Sep 7, 2012 9:37 AM, Ken Schaefer k...@adopenstatic.com wrote:

  I’m pretty sure there’s a direct line between the Adobe Flash people and
 the Microsoft IE people…

 ** **

 *From:* David Lum [mailto:david@nwea.org]
 *Sent:* Friday, 7 September 2012 11:32 PM
 *To:* NT System Admin Issues
 *Subject:* RE: Did y'all know...

 ** **

 “If these policies are retained, then there will be a systematic
 vulnerability window. Microsoft will patch Internet Explorer, and then a
 week or two later, Adobe will reveal a raft of new Flash security flaws
 when it patches Flash. Windows users will then have to wait several weeks
 for Microsoft's next update”

 ** **

 Hopefully MS will sort this one out.

 ** **

 *From:* Richard Stovall [mailto:rich...@gmail.com]
 *Sent:* Thursday, September 06, 2012 7:16 PM
 *To:* NT System Admin Issues
 *Subject:* Did y'all know...

 ** **

 ... that MS baked Flash into IE 10, and that you can't update it outside
 of the Microsoft update release channel?

 ** **

 I discovered this tonight when Secunia PSI was screaming at me to update
 my shiny new Win 8 playpen, but then I couldn't do it because MS won't let
 me.

 ** **


 http://arstechnica.com/information-technology/2012/09/internet-explorer-10s-bundled-flash-leaves-users-exploitable/
 

 ** **

 Wow

 ~ Finally, powerful endpoint security that ISN'T a resource hog! ~
 ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

 ---
 To manage subscriptions click here:
 http://lyris.sunbelt-software.com/read/my_forums/
 or send an email to listmana...@lyris.sunbeltsoftware.com
 with the body: unsubscribe ntsysadmin


~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

Re: Did y'all know...

2012-09-07 Thread Jonathan Link
Bears repeating.
Your confidence in Microsoft amazes me.

On Friday, September 7, 2012, Daniel Rodriguez wrote:

 Yeah. Like two tin cans and string. :)

 Daniel
 On Sep 7, 2012 9:37 AM, Ken Schaefer 
 k...@adopenstatic.comjavascript:_e({}, 'cvml', 'k...@adopenstatic.com');
 wrote:

  I’m pretty sure there’s a direct line between the Adobe Flash people
 and the Microsoft IE people…

 ** **

 *From:* David Lum [mailto:david@nwea.org javascript:_e({}, 'cvml',
 'david@nwea.org');]
 *Sent:* Friday, 7 September 2012 11:32 PM
 *To:* NT System Admin Issues
 *Subject:* RE: Did y'all know...

 ** **

 “If these policies are retained, then there will be a systematic
 vulnerability window. Microsoft will patch Internet Explorer, and then a
 week or two later, Adobe will reveal a raft of new Flash security flaws
 when it patches Flash. Windows users will then have to wait several weeks
 for Microsoft's next update”

 ** **

 Hopefully MS will sort this one out.

 ** **

 *From:* Richard Stovall [mailto:rich...@gmail.com] javascript:_e({},
 'cvml', '[mailto:rich...@gmail.com]');
 *Sent:* Thursday, September 06, 2012 7:16 PM
 *To:* NT System Admin Issues
 *Subject:* Did y'all know...

 ** **

 ... that MS baked Flash into IE 10, and that you can't update it outside
 of the Microsoft update release channel?

 ** **

 I discovered this tonight when Secunia PSI was screaming at me to update
 my shiny new Win 8 playpen, but then I couldn't do it because MS won't let
 me.

 ** **


 http://arstechnica.com/information-technology/2012/09/internet-explorer-10s-bundled-flash-leaves-users-exploitable/
 

 ** **

 Wow

 ~ Finally, powerful endpoint security that ISN'T a resource hog! ~
 ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

 ---
 To manage subscriptions click here:
 http://lyris.sunbelt-software.com/read/my_forums/
 or send an email to listmana...@lyris.sunbeltsoftware.comjavascript:_e({}, 
 'cvml', 'listmana...@lyris.sunbeltsoftware.com');
 with the body: unsubscribe ntsysadmin

 ~ Finally, powerful endpoint security that ISN'T a resource hog! ~
 ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

 ---
 To manage subscriptions click here:
 http://lyris.sunbelt-software.com/read/my_forums/
 or send an email to listmana...@lyris.sunbeltsoftware.comjavascript:_e({}, 
 'cvml', 'listmana...@lyris.sunbeltsoftware.com');
 with the body: unsubscribe ntsysadmin


~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

RE: Latest flash

2012-09-07 Thread Ziots, Edward
Is there another download site for Adobe Reader with the versions on 1
site? 

Z

Edward E. Ziots, CISSP, Security +, Network +
Security Engineer
Lifespan Organization
ezi...@lifespan.org


-Original Message-
From: Glen Johnson [mailto:gjohn...@vhcc.edu] 
Sent: Wednesday, June 13, 2012 10:41 AM
To: NT System Admin Issues
Subject: Latest flash

Anyone have info on the latest flash update 11.3.300.257, specifically
from the distribution page at the url below, there is now only one msi
install for the plugin version and one msi for IE.
The download doesn't specify if it is x32 or x64.
The FAQ is blank at least in my browser.

http://www.adobe.com/products/flashplayer/distribution3.html

~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~
http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here:
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin



RE: Latest flash

2012-09-07 Thread David Lum
www.ninite.com shows they are distributing Flash version 11.4.402.265, which 
seems later than 11.3

-Original Message-
From: Ziots, Edward [mailto:ezi...@lifespan.org] 
Sent: Friday, September 07, 2012 7:52 AM
To: NT System Admin Issues
Subject: RE: Latest flash

Is there another download site for Adobe Reader with the versions on 1 site? 

Z

Edward E. Ziots, CISSP, Security +, Network + Security Engineer Lifespan 
Organization ezi...@lifespan.org


-Original Message-
From: Glen Johnson [mailto:gjohn...@vhcc.edu]
Sent: Wednesday, June 13, 2012 10:41 AM
To: NT System Admin Issues
Subject: Latest flash

Anyone have info on the latest flash update 11.3.300.257, specifically from the 
distribution page at the url below, there is now only one msi install for the 
plugin version and one msi for IE.
The download doesn't specify if it is x32 or x64.
The FAQ is blank at least in my browser.

http://www.adobe.com/products/flashplayer/distribution3.html

~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ 
http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here:
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ 
http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin



RE: Latest flash

2012-09-07 Thread Kennedy, Jim
You can't see the FAQ because your Flash is out of date. ;)

There is just one installer now for 64/32so one for 64/32 plugin and one 
for 64/32 IE.  Not sure what version that changed at, it was fairly recent 
since I still remember it.


-Original Message-
From: Glen Johnson [mailto:gjohn...@vhcc.edu]
Sent: Wednesday, June 13, 2012 10:41 AM
To: NT System Admin Issues
Subject: Latest flash

Anyone have info on the latest flash update 11.3.300.257, specifically from the 
distribution page at the url below, there is now only one msi install for the 
plugin version and one msi for IE.
The download doesn't specify if it is x32 or x64.
The FAQ is blank at least in my browser.

http://www.adobe.com/products/flashplayer/distribution3.html

~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ 
http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here:
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ 
http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin



RE: Did y'all know...

2012-09-07 Thread Mathew Shember
You mean a telephone line or a line in the sand?

From: Ken Schaefer [mailto:k...@adopenstatic.com]
Sent: Friday, September 07, 2012 6:35 AM
To: NT System Admin Issues
Subject: RE: Did y'all know...

I’m pretty sure there’s a direct line between the Adobe Flash people and the 
Microsoft IE people…

From: David Lum [mailto:david@nwea.org]mailto:[mailto:david@nwea.org]
Sent: Friday, 7 September 2012 11:32 PM
To: NT System Admin Issues
Subject: RE: Did y'all know...

“If these policies are retained, then there will be a systematic vulnerability 
window. Microsoft will patch Internet Explorer, and then a week or two later, 
Adobe will reveal a raft of new Flash security flaws when it patches Flash. 
Windows users will then have to wait several weeks for Microsoft's next update”

Hopefully MS will sort this one out.

From: Richard Stovall 
[mailto:rich...@gmail.com]mailto:[mailto:rich...@gmail.com]
Sent: Thursday, September 06, 2012 7:16 PM
To: NT System Admin Issues
Subject: Did y'all know...

... that MS baked Flash into IE 10, and that you can't update it outside of the 
Microsoft update release channel?

I discovered this tonight when Secunia PSI was screaming at me to update my 
shiny new Win 8 playpen, but then I couldn't do it because MS won't let me.

http://arstechnica.com/information-technology/2012/09/internet-explorer-10s-bundled-flash-leaves-users-exploitable/

Wow

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


RE: Java vulnerability Q

2012-09-07 Thread Ziots, Edward
Most times it’s a keylogger or other malicious code downloaded from multiple 
sources that will hook processes inject into other processes (legit) and try to 
remain persistent. 

 

If you can disable java invocation in the Internet Zone, which will stop the 
drive-by’s for the time being. 

 

Z

 

Edward E. Ziots, CISSP, Security +, Network +

Security Engineer

Lifespan Organization

ezi...@lifespan.org

 

From: Kennedy, Jim [mailto:kennedy...@elyriaschools.org] 
Sent: Friday, September 07, 2012 11:14 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

 

The exploit is used to drop code on the target. That is how most of the 
exploits that you hear about are used.  It isn’t that I use Java to get your 
password….I use Java to drop a keylogger on your box to get your password…for 
example.

 

So you are looking for what they dropped.

 

 

From: David Lum [mailto:david@nwea.org] 
Sent: Friday, September 07, 2012 11:09 AM
To: NT System Admin Issues
Subject: Java vulnerability Q

 

If a system has been compromised by the latest Java exploit – how would someone 
know? What would you look for?

David Lum 
Systems Engineer // NWEATM
Office 503.548.5229 // Cell (voice/text) 503.267.9764

 

 

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


RE: Java vulnerability Q

2012-09-07 Thread David Lum
Thanks. If a user gets a message from the Java updater, should they accept it 
if it’s verified from Oracle, or is that potentially an exploit?

From: Ziots, Edward [mailto:ezi...@lifespan.org]
Sent: Friday, September 07, 2012 8:31 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

Most times it’s a keylogger or other malicious code downloaded from multiple 
sources that will hook processes inject into other processes (legit) and try to 
remain persistent.

If you can disable java invocation in the Internet Zone, which will stop the 
drive-by’s for the time being.

Z

Edward E. Ziots, CISSP, Security +, Network +
Security Engineer
Lifespan Organization
ezi...@lifespan.orgmailto:ezi...@lifespan.org

From: Kennedy, Jim 
[mailto:kennedy...@elyriaschools.org]mailto:[mailto:kennedy...@elyriaschools.org]
Sent: Friday, September 07, 2012 11:14 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

The exploit is used to drop code on the target. That is how most of the 
exploits that you hear about are used.  It isn’t that I use Java to get your 
password….I use Java to drop a keylogger on your box to get your password…for 
example.

So you are looking for what they dropped.


From: David Lum [mailto:david@nwea.org]
Sent: Friday, September 07, 2012 11:09 AM
To: NT System Admin Issues
Subject: Java vulnerability Q

If a system has been compromised by the latest Java exploit – how would someone 
know? What would you look for?
David Lum
Systems Engineer // NWEATM
Office 503.548.5229 // Cell (voice/text) 503.267.9764



~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


RE: Java vulnerability Q

2012-09-07 Thread Kennedy, Jim
And then phone home with the loot. netstat for odd outgoing connections.

From: Ziots, Edward [mailto:ezi...@lifespan.org]
Sent: Friday, September 07, 2012 11:33 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

Most times it’s a keylogger or other malicious code downloaded from multiple 
sources that will hook processes inject into other processes (legit) and try to 
remain persistent.

If you can disable java invocation in the Internet Zone, which will stop the 
drive-by’s for the time being.

Z

Edward E. Ziots, CISSP, Security +, Network +
Security Engineer
Lifespan Organization
ezi...@lifespan.orgmailto:ezi...@lifespan.org

From: Kennedy, Jim 
[mailto:kennedy...@elyriaschools.org]mailto:[mailto:kennedy...@elyriaschools.org]
Sent: Friday, September 07, 2012 11:14 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

The exploit is used to drop code on the target. That is how most of the 
exploits that you hear about are used.  It isn’t that I use Java to get your 
password….I use Java to drop a keylogger on your box to get your password…for 
example.

So you are looking for what they dropped.


From: David Lum [mailto:david@nwea.org]
Sent: Friday, September 07, 2012 11:09 AM
To: NT System Admin Issues
Subject: Java vulnerability Q

If a system has been compromised by the latest Java exploit – how would someone 
know? What would you look for?
David Lum
Systems Engineer // NWEATM
Office 503.548.5229 // Cell (voice/text) 503.267.9764



~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


RE: Java vulnerability Q

2012-09-07 Thread Ziots, Edward
I would semi-trust the java updaters, but honestly, I would be pushing java 7 
version 7 if you have a centralized platform for software updates. And if you 
don’t need java on your systems for functionality, remove it altogether. 

 

Z

 

Edward E. Ziots, CISSP, Security +, Network +

Security Engineer

Lifespan Organization

ezi...@lifespan.org

 

From: David Lum [mailto:david@nwea.org] 
Sent: Friday, September 07, 2012 11:37 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

 

Thanks. If a user gets a message from the Java updater, should they accept it 
if it’s verified from Oracle, or is that potentially an exploit?

 

From: Ziots, Edward [mailto:ezi...@lifespan.org] 
Sent: Friday, September 07, 2012 8:31 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

 

Most times it’s a keylogger or other malicious code downloaded from multiple 
sources that will hook processes inject into other processes (legit) and try to 
remain persistent. 

 

If you can disable java invocation in the Internet Zone, which will stop the 
drive-by’s for the time being. 

 

Z

 

Edward E. Ziots, CISSP, Security +, Network +

Security Engineer

Lifespan Organization

ezi...@lifespan.org

 

From: Kennedy, Jim [mailto:kennedy...@elyriaschools.org] 
Sent: Friday, September 07, 2012 11:14 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

 

The exploit is used to drop code on the target. That is how most of the 
exploits that you hear about are used.  It isn’t that I use Java to get your 
password….I use Java to drop a keylogger on your box to get your password…for 
example.

 

So you are looking for what they dropped.

 

 

From: David Lum [mailto:david@nwea.org] 
Sent: Friday, September 07, 2012 11:09 AM
To: NT System Admin Issues
Subject: Java vulnerability Q

 

If a system has been compromised by the latest Java exploit – how would someone 
know? What would you look for?

David Lum 
Systems Engineer // NWEATM
Office 503.548.5229 // Cell (voice/text) 503.267.9764

 

 

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


RE: Java vulnerability Q

2012-09-07 Thread Ziots, Edward
I see these on my IPS, and add to my firewall block list so those nets are dead 
to us going forward. 

 

Again I posted a list of sites in which you can look up these domains/IP 
networks that are usually most virtulent and do a full block egress/ingress.  I 
currently have 500+ networks blocked here and it has lowered issues I have 
seen. 

 

Funny part is the networks are mostly from the USA that is leading the way, 
with an uptick on the stuff seen from FIOS, Coxcable and Road Runner ISP’s..

 

Z

 

Edward E. Ziots, CISSP, Security +, Network +

Security Engineer

Lifespan Organization

ezi...@lifespan.org

 

From: Kennedy, Jim [mailto:kennedy...@elyriaschools.org] 
Sent: Friday, September 07, 2012 11:38 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

 

And then phone home with the loot. netstat for odd outgoing connections. 

 

From: Ziots, Edward [mailto:ezi...@lifespan.org] 
Sent: Friday, September 07, 2012 11:33 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

 

Most times it’s a keylogger or other malicious code downloaded from multiple 
sources that will hook processes inject into other processes (legit) and try to 
remain persistent. 

 

If you can disable java invocation in the Internet Zone, which will stop the 
drive-by’s for the time being. 

 

Z

 

Edward E. Ziots, CISSP, Security +, Network +

Security Engineer

Lifespan Organization

ezi...@lifespan.org

 

From: Kennedy, Jim [mailto:kennedy...@elyriaschools.org] 
Sent: Friday, September 07, 2012 11:14 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

 

The exploit is used to drop code on the target. That is how most of the 
exploits that you hear about are used.  It isn’t that I use Java to get your 
password….I use Java to drop a keylogger on your box to get your password…for 
example.

 

So you are looking for what they dropped.

 

 

From: David Lum [mailto:david@nwea.org] 
Sent: Friday, September 07, 2012 11:09 AM
To: NT System Admin Issues
Subject: Java vulnerability Q

 

If a system has been compromised by the latest Java exploit – how would someone 
know? What would you look for?

David Lum 
Systems Engineer // NWEATM
Office 503.548.5229 // Cell (voice/text) 503.267.9764

 

 

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


RE: Java vulnerability Q

2012-09-07 Thread Kennedy, Jim
I am betting you intentionally skip over the hidden tidbit in his question.

“If a user gets a message from the Java updater, should they accept it…”

What kind of user can install a Java update? ☺


From: Ziots, Edward [mailto:ezi...@lifespan.org]
Sent: Friday, September 07, 2012 11:54 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

I would semi-trust the java updaters, but honestly, I would be pushing java 7 
version 7 if you have a centralized platform for software updates. And if you 
don’t need java on your systems for functionality, remove it altogether.

Z

Edward E. Ziots, CISSP, Security +, Network +
Security Engineer
Lifespan Organization
ezi...@lifespan.orgmailto:ezi...@lifespan.org

From: David Lum [mailto:david@nwea.org]mailto:[mailto:david@nwea.org]
Sent: Friday, September 07, 2012 11:37 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

Thanks. If a user gets a message from the Java updater, should they accept it 
if it’s verified from Oracle, or is that potentially an exploit?

From: Ziots, Edward [mailto:ezi...@lifespan.org]
Sent: Friday, September 07, 2012 8:31 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

Most times it’s a keylogger or other malicious code downloaded from multiple 
sources that will hook processes inject into other processes (legit) and try to 
remain persistent.

If you can disable java invocation in the Internet Zone, which will stop the 
drive-by’s for the time being.

Z

Edward E. Ziots, CISSP, Security +, Network +
Security Engineer
Lifespan Organization
ezi...@lifespan.orgmailto:ezi...@lifespan.org

From: Kennedy, Jim 
[mailto:kennedy...@elyriaschools.org]mailto:[mailto:kennedy...@elyriaschools.org]
Sent: Friday, September 07, 2012 11:14 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

The exploit is used to drop code on the target. That is how most of the 
exploits that you hear about are used.  It isn’t that I use Java to get your 
password….I use Java to drop a keylogger on your box to get your password…for 
example.

So you are looking for what they dropped.


From: David Lum [mailto:david@nwea.org]
Sent: Friday, September 07, 2012 11:09 AM
To: NT System Admin Issues
Subject: Java vulnerability Q

If a system has been compromised by the latest Java exploit – how would someone 
know? What would you look for?
David Lum
Systems Engineer // NWEATM
Office 503.548.5229 // Cell (voice/text) 503.267.9764



~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


RE: Java vulnerability Q

2012-09-07 Thread David Lum
I have an SMS package (two, actually) and Shavlik and am pushing with both. I 
still get some users asking about the Java updater and since our main product 
here uses Java (and our outsourced HR stuff uses it) , I can’t really pull it 
off anything…

I’m getting to the Windows machines, the Mac’s and others…no way to know…

From: Ziots, Edward [mailto:ezi...@lifespan.org]
Sent: Friday, September 07, 2012 8:41 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

I would semi-trust the java updaters, but honestly, I would be pushing java 7 
version 7 if you have a centralized platform for software updates. And if you 
don’t need java on your systems for functionality, remove it altogether.

Z

Edward E. Ziots, CISSP, Security +, Network +
Security Engineer
Lifespan Organization
ezi...@lifespan.orgmailto:ezi...@lifespan.org

From: David Lum [mailto:david@nwea.org]mailto:[mailto:david@nwea.org]
Sent: Friday, September 07, 2012 11:37 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

Thanks. If a user gets a message from the Java updater, should they accept it 
if it’s verified from Oracle, or is that potentially an exploit?

From: Ziots, Edward [mailto:ezi...@lifespan.org]
Sent: Friday, September 07, 2012 8:31 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

Most times it’s a keylogger or other malicious code downloaded from multiple 
sources that will hook processes inject into other processes (legit) and try to 
remain persistent.

If you can disable java invocation in the Internet Zone, which will stop the 
drive-by’s for the time being.

Z

Edward E. Ziots, CISSP, Security +, Network +
Security Engineer
Lifespan Organization
ezi...@lifespan.orgmailto:ezi...@lifespan.org

From: Kennedy, Jim 
[mailto:kennedy...@elyriaschools.org]mailto:[mailto:kennedy...@elyriaschools.org]
Sent: Friday, September 07, 2012 11:14 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

The exploit is used to drop code on the target. That is how most of the 
exploits that you hear about are used.  It isn’t that I use Java to get your 
password….I use Java to drop a keylogger on your box to get your password…for 
example.

So you are looking for what they dropped.


From: David Lum [mailto:david@nwea.org]
Sent: Friday, September 07, 2012 11:09 AM
To: NT System Admin Issues
Subject: Java vulnerability Q

If a system has been compromised by the latest Java exploit – how would someone 
know? What would you look for?
David Lum
Systems Engineer // NWEATM
Office 503.548.5229 // Cell (voice/text) 503.267.9764



~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


RE: OTish Adobe Reader issues.

2012-09-07 Thread Stephen Holtz
Yes.  Starting to move to a new platform for reading PDF’s

 

Stephen L. Holtz, MCSE, MCT
Director of Information Technology
Addison Reserve Country Club
7201 Addison Reserve Blvd.
Delray Beach, Fl. 33446
Ph: 561-455-1220
Cell: 561-441-0646

 http://www.addisonreserve.cc/ www.addisonreserve.cc

Description: ARLogoDescription: PlatinumClub

Proudly recognized as a 5-Star

Platinum Club of America.

 

This e-mail, and any attachments thereto, is intended only for use by the 
addressee(s) named herein and may contain legally privileged and/or 
confidential information. If you are not the intended recipient of this e-mail, 
you are hereby notified that any dissemination, distribution or copying of this 
e-mail, and any attachments thereto, is strictly prohibited. If you have 
received this e-mail in error, please notify me by replying to this message and 
permanently delete the original and any copy of this e-mail and any printout 
thereof.

 

From: Kennedy, Jim [mailto:kennedy...@elyriaschools.org] 
Sent: Friday, September 07, 2012 11:47 AM
To: NT System Admin Issues
Subject: OTish Adobe Reader issues.

 

Anyone seeing problems with Reader and XP recently.  We have had a significant 
number of PDF readers that open the file and then it hour glasses on them for a 
long long time. Just started out of the blue. I have not pushed any new Readers 
updates in a while. It keeps coming back to them, we have even re-imaged a few 
of the machines and manually installed the latest Reader with similar results.

 

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadminimage001.jpgimage002.jpg

RE: Java vulnerability Q

2012-09-07 Thread David Lum
Thanks. Kind of what I was afraid of.

From: Kennedy, Jim [mailto:kennedy...@elyriaschools.org]
Sent: Friday, September 07, 2012 8:14 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

The exploit is used to drop code on the target. That is how most of the 
exploits that you hear about are used.  It isn’t that I use Java to get your 
password….I use Java to drop a keylogger on your box to get your password…for 
example.

So you are looking for what they dropped.


From: David Lum [mailto:david@nwea.org]mailto:[mailto:david@nwea.org]
Sent: Friday, September 07, 2012 11:09 AM
To: NT System Admin Issues
Subject: Java vulnerability Q

If a system has been compromised by the latest Java exploit – how would someone 
know? What would you look for?
David Lum
Systems Engineer // NWEATM
Office 503.548.5229 // Cell (voice/text) 503.267.9764



~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


RE: Java vulnerability Q

2012-09-07 Thread David Lum
I my environment, anyone, because they’re all local admins. I don’t think it’s 
entirely my fault,  but it’s not because I haven’t tried to change it….the 
Service Desk guys are unwilling to make the effort and neither is 
management…I’ve vented about that here before.

From: Kennedy, Jim [mailto:kennedy...@elyriaschools.org]
Sent: Friday, September 07, 2012 8:56 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

I am betting you intentionally skip over the hidden tidbit in his question.

“If a user gets a message from the Java updater, should they accept it…”

What kind of user can install a Java update? ☺


From: Ziots, Edward 
[mailto:ezi...@lifespan.org]mailto:[mailto:ezi...@lifespan.org]
Sent: Friday, September 07, 2012 11:54 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

I would semi-trust the java updaters, but honestly, I would be pushing java 7 
version 7 if you have a centralized platform for software updates. And if you 
don’t need java on your systems for functionality, remove it altogether.

Z

Edward E. Ziots, CISSP, Security +, Network +
Security Engineer
Lifespan Organization
ezi...@lifespan.orgmailto:ezi...@lifespan.org

From: David Lum [mailto:david@nwea.org]mailto:[mailto:david@nwea.org]
Sent: Friday, September 07, 2012 11:37 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

Thanks. If a user gets a message from the Java updater, should they accept it 
if it’s verified from Oracle, or is that potentially an exploit?

From: Ziots, Edward [mailto:ezi...@lifespan.org]
Sent: Friday, September 07, 2012 8:31 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

Most times it’s a keylogger or other malicious code downloaded from multiple 
sources that will hook processes inject into other processes (legit) and try to 
remain persistent.

If you can disable java invocation in the Internet Zone, which will stop the 
drive-by’s for the time being.

Z

Edward E. Ziots, CISSP, Security +, Network +
Security Engineer
Lifespan Organization
ezi...@lifespan.orgmailto:ezi...@lifespan.org

From: Kennedy, Jim 
[mailto:kennedy...@elyriaschools.org]mailto:[mailto:kennedy...@elyriaschools.org]
Sent: Friday, September 07, 2012 11:14 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

The exploit is used to drop code on the target. That is how most of the 
exploits that you hear about are used.  It isn’t that I use Java to get your 
password….I use Java to drop a keylogger on your box to get your password…for 
example.

So you are looking for what they dropped.


From: David Lum [mailto:david@nwea.org]
Sent: Friday, September 07, 2012 11:09 AM
To: NT System Admin Issues
Subject: Java vulnerability Q

If a system has been compromised by the latest Java exploit – how would someone 
know? What would you look for?
David Lum
Systems Engineer // NWEATM
Office 503.548.5229 // Cell (voice/text) 503.267.9764



~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 

APP-V for 2008R2 terminal services

2012-09-07 Thread jesse-r...@wi.rr.com
I'm trying to understand why a previous vendor (who no longer supports
them) at one of my customers had setup a 2008 R2 terminal server to use MS
APP-V.

The environment consists of 25 thin client devices in a school/lab setting.
The ONLY software used on the terminal server is Office 2007 and Internet
Explorer.  I can't seem to determine why the vendor bothered with building
a separate MS APP-V server for Office 2007.  Why not just load Office 2007
on the terminal server?  It's not taxed as far as resources go.  There is
no other software loaded on the terminal server that conflicts with Office
2007 so...  why APP-V?   

Thinking about building a replacment terminal server, and installing Office
2010 on it.  My experience with APP-V is basically nil... but guessing at
this point, it's not needed at all for an environment like this one?

Regards
J




mail2web.com - Microsoft® Exchange solutions from a leading provider -
http://link.mail2web.com/Business/Exchange



~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin



Re: APP-V for 2008R2 terminal services

2012-09-07 Thread Rankin, James R
App-V let's you run the software without installing it, speaking simply, so it 
can get around a lot of conflicts due to the isolation it offers, but if there 
are no conflictstotal overkill.

For a small setup the simple overhead of creating and updating app sequences 
makes it unsuitable. I'd rip and replace it unless there is some software that 
necessitates the extra complexity, of which there seems to be none.

Cheers,


JR 
--Original Message--
From: jesse-r...@wi.rr.com
To: NT System Admin Issues
ReplyTo: NT System Admin Issues
Subject: APP-V for 2008R2 terminal services
Sent: 7 Sep 2012 17:55

I'm trying to understand why a previous vendor (who no longer supports
them) at one of my customers had setup a 2008 R2 terminal server to use MS
APP-V.

The environment consists of 25 thin client devices in a school/lab setting.
The ONLY software used on the terminal server is Office 2007 and Internet
Explorer.  I can't seem to determine why the vendor bothered with building
a separate MS APP-V server for Office 2007.  Why not just load Office 2007
on the terminal server?  It's not taxed as far as resources go.  There is
no other software loaded on the terminal server that conflicts with Office
2007 so...  why APP-V?   

Thinking about building a replacment terminal server, and installing Office
2010 on it.  My experience with APP-V is basically nil... but guessing at
this point, it's not needed at all for an environment like this one?

Regards
J




mail2web.com - Microsoft® Exchange solutions from a leading provider -
http://link.mail2web.com/Business/Exchange



~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


---Blackberried
~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

Re: APP-V for 2008R2 terminal services

2012-09-07 Thread Webster
Because they were either stupid or just didn't know what they were doing
(or both).

Office 2xxx belongs in the base image.


Carl Webster
Consultant and Citrix Technology Professional
http://www.CarlWebster.com http://www.carlwebster.com/






On 9/7/12 12:55 PM, jesse-r...@wi.rr.com jesse-r...@wi.rr.com wrote:

I'm trying to understand why a previous vendor (who no longer supports
them) at one of my customers had setup a 2008 R2 terminal server to use MS
APP-V.

The environment consists of 25 thin client devices in a school/lab
setting.
The ONLY software used on the terminal server is Office 2007 and Internet
Explorer.  I can't seem to determine why the vendor bothered with building
a separate MS APP-V server for Office 2007.  Why not just load Office 2007
on the terminal server?  It's not taxed as far as resources go.  There is
no other software loaded on the terminal server that conflicts with Office
2007 so...  why APP-V?

Thinking about building a replacment terminal server, and installing
Office
2010 on it.  My experience with APP-V is basically nil... but guessing at
this point, it's not needed at all for an environment like this one?



~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin



Re: APP-V for 2008R2 terminal services

2012-09-07 Thread Rankin, James R
Agreed, unless you've got really poor Office add-ons that can't co-exist

---Blackberried

-Original Message-
From: Webster webs...@carlwebster.com
Date: Fri, 7 Sep 2012 17:15:49 
To: NT System Admin Issuesntsysadmin@lyris.sunbelt-software.com
Reply-To: NT System Admin Issues 
ntsysadmin@lyris.sunbelt-software.comSubject: Re: APP-V for 2008R2 terminal 
services

Because they were either stupid or just didn't know what they were doing
(or both).

Office 2xxx belongs in the base image.


Carl Webster
Consultant and Citrix Technology Professional
http://www.CarlWebster.com http://www.carlwebster.com/






On 9/7/12 12:55 PM, jesse-r...@wi.rr.com jesse-r...@wi.rr.com wrote:

I'm trying to understand why a previous vendor (who no longer supports
them) at one of my customers had setup a 2008 R2 terminal server to use MS
APP-V.

The environment consists of 25 thin client devices in a school/lab
setting.
The ONLY software used on the terminal server is Office 2007 and Internet
Explorer.  I can't seem to determine why the vendor bothered with building
a separate MS APP-V server for Office 2007.  Why not just load Office 2007
on the terminal server?  It's not taxed as far as resources go.  There is
no other software loaded on the terminal server that conflicts with Office
2007 so...  why APP-V?

Thinking about building a replacment terminal server, and installing
Office
2010 on it.  My experience with APP-V is basically nil... but guessing at
this point, it's not needed at all for an environment like this one?



~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin


~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

RE: Java vulnerability Q

2012-09-07 Thread Derek Harris
That’s scary.

One of the first things I did when I started here 12 years ago is take away 
local admin from everyone. I got some pushback, griping, and even threats 
initially, but we haven’t had any malware since, and we can directly control 
what gets installed on PCs. The result is that the systems are more secure, 
reliable, and cheaper to operate.


From: David Lum [mailto:david@nwea.org]
Sent: Friday, September 07, 2012 10:20
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

I my environment, anyone, because they’re all local admins. I don’t think it’s 
entirely my fault,  but it’s not because I haven’t tried to change it….the 
Service Desk guys are unwilling to make the effort and neither is 
management…I’ve vented about that here before.

From: Kennedy, Jim 
[mailto:kennedy...@elyriaschools.org]mailto:[mailto:kennedy...@elyriaschools.org]
Sent: Friday, September 07, 2012 8:56 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

I am betting you intentionally skip over the hidden tidbit in his question.

“If a user gets a message from the Java updater, should they accept it…”

What kind of user can install a Java update? ☺


From: Ziots, Edward 
[mailto:ezi...@lifespan.org]mailto:[mailto:ezi...@lifespan.org]
Sent: Friday, September 07, 2012 11:54 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

I would semi-trust the java updaters, but honestly, I would be pushing java 7 
version 7 if you have a centralized platform for software updates. And if you 
don’t need java on your systems for functionality, remove it altogether.

Z

Edward E. Ziots, CISSP, Security +, Network +
Security Engineer
Lifespan Organization
ezi...@lifespan.orgmailto:ezi...@lifespan.org

From: David Lum [mailto:david@nwea.org]mailto:[mailto:david@nwea.org]
Sent: Friday, September 07, 2012 11:37 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

Thanks. If a user gets a message from the Java updater, should they accept it 
if it’s verified from Oracle, or is that potentially an exploit?

From: Ziots, Edward [mailto:ezi...@lifespan.org]
Sent: Friday, September 07, 2012 8:31 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

Most times it’s a keylogger or other malicious code downloaded from multiple 
sources that will hook processes inject into other processes (legit) and try to 
remain persistent.

If you can disable java invocation in the Internet Zone, which will stop the 
drive-by’s for the time being.

Z

Edward E. Ziots, CISSP, Security +, Network +
Security Engineer
Lifespan Organization
ezi...@lifespan.orgmailto:ezi...@lifespan.org

From: Kennedy, Jim 
[mailto:kennedy...@elyriaschools.org]mailto:[mailto:kennedy...@elyriaschools.org]
Sent: Friday, September 07, 2012 11:14 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

The exploit is used to drop code on the target. That is how most of the 
exploits that you hear about are used.  It isn’t that I use Java to get your 
password….I use Java to drop a keylogger on your box to get your password…for 
example.

So you are looking for what they dropped.


From: David Lum [mailto:david@nwea.org]
Sent: Friday, September 07, 2012 11:09 AM
To: NT System Admin Issues
Subject: Java vulnerability Q

If a system has been compromised by the latest Java exploit – how would someone 
know? What would you look for?
David Lum
Systems Engineer // NWEATM
Office 503.548.5229 // Cell (voice/text) 503.267.9764



~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource 

RE: Java vulnerability Q

2012-09-07 Thread David Lum
Preaching to the choir, brother ☺. Environments under my full control don’t 
have users as local admins, but %dayjob% isn’t one of them.

From: Derek Harris [mailto:dhar...@panoramaortho.com]
Sent: Friday, September 07, 2012 1:41 PM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

That’s scary.

One of the first things I did when I started here 12 years ago is take away 
local admin from everyone. I got some pushback, griping, and even threats 
initially, but we haven’t had any malware since, and we can directly control 
what gets installed on PCs. The result is that the systems are more secure, 
reliable, and cheaper to operate.


From: David Lum [mailto:david@nwea.org]mailto:[mailto:david@nwea.org]
Sent: Friday, September 07, 2012 10:20
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

I my environment, anyone, because they’re all local admins. I don’t think it’s 
entirely my fault,  but it’s not because I haven’t tried to change it….the 
Service Desk guys are unwilling to make the effort and neither is 
management…I’ve vented about that here before.

From: Kennedy, Jim 
[mailto:kennedy...@elyriaschools.org]mailto:[mailto:kennedy...@elyriaschools.org]
Sent: Friday, September 07, 2012 8:56 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

I am betting you intentionally skip over the hidden tidbit in his question.

“If a user gets a message from the Java updater, should they accept it…”

What kind of user can install a Java update? ☺


From: Ziots, Edward 
[mailto:ezi...@lifespan.org]mailto:[mailto:ezi...@lifespan.org]
Sent: Friday, September 07, 2012 11:54 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

I would semi-trust the java updaters, but honestly, I would be pushing java 7 
version 7 if you have a centralized platform for software updates. And if you 
don’t need java on your systems for functionality, remove it altogether.

Z

Edward E. Ziots, CISSP, Security +, Network +
Security Engineer
Lifespan Organization
ezi...@lifespan.orgmailto:ezi...@lifespan.org

From: David Lum [mailto:david@nwea.org]mailto:[mailto:david@nwea.org]
Sent: Friday, September 07, 2012 11:37 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

Thanks. If a user gets a message from the Java updater, should they accept it 
if it’s verified from Oracle, or is that potentially an exploit?

From: Ziots, Edward [mailto:ezi...@lifespan.org]
Sent: Friday, September 07, 2012 8:31 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

Most times it’s a keylogger or other malicious code downloaded from multiple 
sources that will hook processes inject into other processes (legit) and try to 
remain persistent.

If you can disable java invocation in the Internet Zone, which will stop the 
drive-by’s for the time being.

Z

Edward E. Ziots, CISSP, Security +, Network +
Security Engineer
Lifespan Organization
ezi...@lifespan.orgmailto:ezi...@lifespan.org

From: Kennedy, Jim 
[mailto:kennedy...@elyriaschools.org]mailto:[mailto:kennedy...@elyriaschools.org]
Sent: Friday, September 07, 2012 11:14 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q

The exploit is used to drop code on the target. That is how most of the 
exploits that you hear about are used.  It isn’t that I use Java to get your 
password….I use Java to drop a keylogger on your box to get your password…for 
example.

So you are looking for what they dropped.


From: David Lum [mailto:david@nwea.org]
Sent: Friday, September 07, 2012 11:09 AM
To: NT System Admin Issues
Subject: Java vulnerability Q

If a system has been compromised by the latest Java exploit – how would someone 
know? What would you look for?
David Lum
Systems Engineer // NWEATM
Office 503.548.5229 // Cell (voice/text) 503.267.9764



~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ 

RE: Java vulnerability Q

2012-09-07 Thread Jon Harris

As you are well aware some organizations are not as security aware as others.  
I just had to remove Java 7 v 7 from my daughters machine as her University 
secure(?) connection would not work with Java 7. Jon
 Subject: RE: Java vulnerability Q
Date: Fri, 7 Sep 2012 11:40:57 -0400
From: ezi...@lifespan.org
To: ntsysadmin@lyris.sunbelt-software.com

I would semi-trust the java updaters, but honestly, I would be pushing java 7 
version 7 if you have a centralized platform for software updates. And if you 
don’t need java on your systems for functionality, remove it altogether.  Z 
Edward E. Ziots, CISSP, Security +, Network +Security EngineerLifespan 
organizationezi...@lifespan.org From: David Lum [mailto:david@nwea.org] 
Sent: Friday, September 07, 2012 11:37 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q Thanks. If a user gets a message from the 
Java updater, should they accept it if it’s verified from Oracle, or is that 
potentially an exploit? From: Ziots, Edward [mailto:ezi...@lifespan.org] 
Sent: Friday, September 07, 2012 8:31 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q Most times it’s a keylogger or other 
malicious code downloaded from multiple sources that will hook processes inject 
into other processes (legit) and try to remain persistent.  If you can disable 
java invocation in the Internet Zone, which will stop the drive-by’s for the 
time being.  Z Edward E. Ziots, CISSP, Security +, Network +Security 
EngineerLifespan organizationezi...@lifespan.org From: Kennedy, Jim 
[mailto:kennedy...@elyriaschools.org] 
Sent: Friday, September 07, 2012 11:14 AM
To: NT System Admin Issues
Subject: RE: Java vulnerability Q The exploit is used to drop code on the 
target. That is how most of the exploits that you hear about are used.  It 
isn’t that I use Java to get your password….I use Java to drop a keylogger on 
your box to get your password…for example. So you are looking for what they 
dropped.  From: David Lum [mailto:david@nwea.org] 
Sent: Friday, September 07, 2012 11:09 AM
To: NT System Admin Issues
Subject: Java vulnerability Q If a system has been compromised by the latest 
Java exploit – how would someone know? What would you look for?David Lum 
Systems Engineer // NWEATM
Office 503.548.5229 // Cell (voice/text) 503.267.9764  ~ Finally, powerful 
endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin~ Finally, powerful endpoint security that 
ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin~ Finally, powerful endpoint security that 
ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin~ Finally, powerful endpoint security that 
ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin
~ Finally, powerful endpoint security that ISN'T a resource hog! ~

~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~



---

To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/

or send an email to listmana...@lyris.sunbeltsoftware.com

with the body: unsubscribe ntsysadmin   
  
~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin

Azure?

2012-09-07 Thread Ryan Finnesey
Has anyone been deploying VMs on Azure?  I need to role out SharePoint, XenAPP, 
AD, System Center , Dynamics CRM and Dynamics AX. I was thinking of completely 
using Azure.

Cheers
Ryan



~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin



Re: Azure?

2012-09-07 Thread Richard Stovall
No, I haven't, but I'll gladly pay your first year's fee for blog hosting
if you'll do it first and describe the entire process in detail.

:-)

On Fri, Sep 7, 2012 at 8:05 PM, Ryan Finnesey r...@finnesey.com wrote:

 Has anyone been deploying VMs on Azure?  I need to role out SharePoint,
 XenAPP, AD, System Center , Dynamics CRM and Dynamics AX. I was thinking of
 completely using Azure.

 Cheers
 Ryan



 ~ Finally, powerful endpoint security that ISN'T a resource hog! ~
 ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

 ---
 To manage subscriptions click here:
 http://lyris.sunbelt-software.com/read/my_forums/
 or send an email to listmana...@lyris.sunbeltsoftware.com
 with the body: unsubscribe ntsysadmin



~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/  ~

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe ntsysadmin